CYB 6030 Wilmington Week 2 McAfee Network Security Platform Case Study Questions Week 2 Readings and Resources The following readings support this week’s

CYB 6030 Wilmington Week 2 McAfee Network Security Platform Case Study Questions Week 2 Readings and Resources

The following readings support this week’s activities. Specific resources are noted with each assignment.

McAfee Network Security Platform (NSP) User Guide
McAfee Advanced Threat Detection (ATD) User Guide
McAfee Enterprise Security Manager (ESM) User Guide
Hacking exposed: network security secrets and solutions. (McClure, S., Scambray, J., Kurtz, G., & Kurtz. (2009)
Network security through data analysis: building situational awareness, Chapters 1 – 4 (Collins, M., & Collins, M. S., 2014)
Week 2 Discussion Board
Watch the following videos from the MTA Network Fundamentals 98-366 Training Course: Network Fundamentals 1 and Networking Fundamentals 2.

Networking Fundamentals: 01 Understanding Local Area Networking (Links to an external site.)

Networking Fundamentals: 02 Defining Networks with the OSI Model (Links to an external site.)

Research and discuss the concept of Confidentiality, Integrity and Availability (CIA)
Discuss the OSI Model and why it is so important for security.
Research and discuss one recent cyber incident and how the attack was able to be carried out. Be specific about the details of the attack.

Please post your initial response by Wednesday 11:55 and respond to two classmates posts by Sunday 11:55.

Week 2 Case Study Questions
INSTRUCTIONS
Save the attached assignment file to your computer.
Read the instructions for the assignment carefully.
Answer all of the questions on the assignment.
Provide Citations and References for all research sources that you use. If you need help with citations and references, click this link: APA Citation Style (Cornell University, 2011). (Links to an external site.)
Upload your competed assignment and submit.
ATTACHMENTS
Week 2 – Case Study.pdf
CYB6030Week2CaseStudyQuestions.docx
Week 2 Hands-on Exercise
INSTRUCTIONS
Save the attached assignment file to your computer.
Read the instructions for the assignment carefully.
Answer all of the questions on the assignment.
Provide Citations and References for all research sources that you use. If you need help with citations and references, click this link: APA Citation Style (Cornell University, 2011). (Links to an external site.)
Upload your competed assignment and submit.
ATTACHMENTS
CYB6030Week2HandsOnExercise.docx CYB 6030: Week 2 Case Study Questions:
A. Please read the following paper:
Shameli-Sendi, A., Aghababaei-Barzegar, R., & Cheriet, M. (2016). Taxonomy of
information security risk assessment (ISRA). Computers & Security, 57, 14-30.
B. After you read the paper, answer the following questions:
1) In one paragraph, briefly describe the ISRA model?
2) In one paragraph, briefly describe why the ISRA model is different.
3) In one-two paragraphs, briefly describe other security models.
4) In less than one page, how could the Wilmington University use the ISRA model?
CYB 6010: Week 2 Hands-on Exercise
A. Read and Review the McAfee Network Security Platform (NSP) User Guide
B. After reading and reviewing the McAfee Network Security Platform (NSP) User Guide, perform
the following steps/exercises:
1.
2.
3.
4.
5.
6.
7.
8.
Logon to the VM
Login to the NSP
Logon to the NSM
Ensure Week 2 traffic has been processed through the NSP
Analyze the alerts that appear on the NSM console
Take a screenshot of the NSM console with the top 10 alerts
Research and write a report for the top 10 alerts that appear within the NSM Alert tab
Submit a single file with the screenshot, research for top 10 alerts and recommendations –
the paper should not exceed 5 pages.
HACKING EXPOSED:
NETWORK SECURITY
SECRETS & SOLUTIONS
SECOND EDITION
This page intentionally left blank.
HACKING EXPOSED:
NETWORK SECURITY
SECRETS & SOLUTIONS
SECOND EDITION
JOEL SCAMBRAY
STUART MCCLURE
GEORGE KURTZ
Osborne/McGraw-Hill
Berkeley New York St. Louis San Francisco
Auckland Bogotá Hamburg London Madrid
Mexico City Milan Montreal New Delhi Panama City
Paris São Paulo Singapore Sydney
Tokyo Toronto
abc
McGraw-Hill
Copyright © 2001 by The McGraw-Hill Companies. All rights reserved. Manufactured in the United States of America. Except as permitted under the United States Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by
any means, or stored in a database or retrieval system, without the prior written permission of the publisher.
0-07-219214-3
The material in this eBook also appears in the print version of this title: 0-07-212748-1.
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark. Where such designations appear in this book, they have been printed with initial caps.
McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate
training programs. For more information, please contact George Hoare, Special Sales, at george_hoare@mcgraw-hill.com or (212)
904-4069.
TERMS OF USE
This is a copyrighted work and The McGraw-Hill Companies, Inc. (“McGraw-Hill”) and its licensors reserve all rights in and to the
work. Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and
retrieve one copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works
based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your
right to use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS”. McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES
AS TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE
WORK, INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR
OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its
licensors do not warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will
be uninterrupted or error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error
or omission, regardless of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any
indirect, incidental, special, punitive, consequential or similar damages that result from the use of or inability to use the work, even
if any of them has been advised of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause arises in contract, tort or otherwise.
DOI: 10.1036/0072192143
To my parents and their parents, who set me on the path; to my wife,
who continues to guide me along it; and to my children, who have
taken it in miraculous new directions.
—Joel Scambray
To my wife and child, without whose love and support little else would
matter; and to my parents for their continuing confidence in me.
—Stuart McClure
This book is dedicated to my loving wife, Anna. I could not have
completed two editions of this book without her understanding,
support, and continuous encouragement. I also would like to thank my
entire family for their assistance in helping me “find the time” when
deadlines seemed impossible.
—George Kurtz
To those who seek the truth, may they continue to search free from
restraint and censorship.
—The Authors
vi
Hacking Exposed: Network Security Secrets and Solutions
About the Authors
Joel Scambray
Joel Scambray is a Principal of Foundstone Inc. (http://www
.foundstone.com), where he provides information system security
consulting services to clients ranging from members of the Fortune 50
to newly minted startups. He has field-tested knowledge of numerous
security technologies and has designed and analyzed security architectures for a variety of applications and products. Mr. Scambray’s
regular publications include the monthly “Ask Us About…Security”
(http://www.microsoft.com/technet/security/) for Microsoft’s
TechNet web site, and the weekly “Security Watch” column in
InfoWorld magazine (http://www.infoworld.com/security), where he has additionally
published over a dozen technology product analyses. He has held positions as a Manager
for Ernst & Young LLP’s eSecurity Solutions group, Senior Test Center Analyst for
InfoWorld, and Director of IT for a major commercial real estate firm. Mr. Scambray is a
Certified Information Systems Security Professional (CISSP) and Certified Checkpoint
Security Engineer (CCSE).
Joel Scambray can be reached at joel@hackingexposed.com.
Stuart McClure
Stuart McClure is President/CTO of Foundstone, Inc. (http://www
.foundstone.com) and has over 10 years of IT and security experience.
Mr. McClure specializes in security assessments, firewall reviews,
e-commerce application testing, hosts reviews, PKI technologies,
intrusion detection, and incident response. For over two years,
Mr. McClure has co-authored a weekly column on security called
“Security Watch” for InfoWorld magazine, a global security column
addressing topical security issues, exploits, and vulnerabilities.
Mr. McClure has spent the past four years with the both Big 5 security
consulting and the InfoWorld Test Center where he tested dozens of network and security
hardware and software products. Prior to InfoWorld, Mr. McClure spent over seven years
managing and securing networks and systems ranging from Cisco, Novell, Solaris, AIX,
AS/400, Window NT, and Linux in corporate, academic, and government landscapes.
Stuart McClure can be reached at stuart@hackingexposed.com.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
About the Authors
George Kurtz
George Kurtz is CEO of Foundstone (http://www.foundstone.com), a
cutting edge security consulting and training organization. Mr. Kurtz
is an internationally recognized security expert and has performed
hundreds of firewall, network, and e-commerce related security assessments throughout his security consulting career. Mr. Kurtz has
significant experience with intrusion detection and firewall technologies, incident response procedures, and remote access solutions. He is
regular speaker at many security conferences and has been quoted in a
wide range of publications, including The Wall Street Journal,
InfoWorld, USA Today, and the Associated Press. Mr. Kurtz is routinely called to comment
on breaking security events and has been featured on various television stations, including CNN, CNBC, NBC, and ABC.
George Kurtz can be reached at george@hackingexposed.com.
vii
viii
Hacking Exposed: Network Security Secrets and Solutions
About the Technical Reviewers
Saumil Shah
Saumil Shah provides information security consulting services to Foundstone clients,
specializing in ethical hacking and security architecture. He holds a designation as a Certified Information Systems Security Professional (CISSP). Mr. Shah has over six years of
experience with system administration, network architecture, integrating heterogeneous
platforms and information security, and has performed numerous ethical hacking
exercises for many significant companies in the IT arena. Prior to joining Foundstone,
Mr. Shah was a senior consultant with Ernst & Young where he was responsible for their
ethical hacking and security architecture solutions. Mr. Shah has also authored a book
titled The Anti-Virus Book, published by Tata McGraw-Hill India, and he worked at the
Indian Institute of Management, Ahmedabad, as a research assistant.
Saumil Shah can be reached at saumil.shah@foundstone.com.
Victor Robert “Bob” Garza
Bob Garza is a Senior IT Network Engineer for a large multinational corporation in the
Silicon Valley. His primary areas of responsibility include operational support, network
management, and security for a network with over 25 thousand hosts. He has over 20
years of experience in the computing industry and is author of several “For Dummies”
books. Mr. Garza has also written reviews of networking and security products for
InfoWorld and Federal Computer Week for the past nine years. Mr. Garza holds an M.S. in
Telecommunications Management and a B.S. in Information Systems Management.
Eric Schultze
Eric Schultze has been involved with information technology and security for the past
nine years, with a majority of his time focused on assessing and securing Microsoft technologies and platforms. He is a frequent speaker at security conferences including
NetWorld Interop, Usenix, BlackHat, SANS, and MIS and is a faculty instructor for the
Computer Security Institute. Mr. Schultze has also appeared on TV and in many publications including NBC, CNBC, TIME, ComputerWorld, and The Standard. Mr. Schultz’s
prior employers include Foundstone, Inc., SecurityFocus.com, Ernst & Young, Price
Waterhouse, Bealls Inc., and Salomon Brothers. A contributing author to the first
edition of Hacking Exposed, he is currently a Security Program Manager for a software
development company.
Martin W. Dolphin
Martin Dolphin is Senior Manager of Security Technology Solutions in the New England
Practice for Ernst & Young. Mr. Dolphin has more than 10 years of computer administration experience with more than 5 years of security experience specializing in Windows NT,
Novell NetWare, and Internet security. Mr. Dolphin can also be found teaching the
Extreme Hacking—Defending Your Site class.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
CONTENTS
Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
xvii
xxi
xxiii
Part 1
Casing the Establishment
Case Study: Target Acquisition . . . . . . . . . . . . . . . . . . . .
2
▼ 1 Footprinting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
6
6
6
8
13
22
27
31
What Is Footprinting? . . . . . . . . . . . . . . . . .
Why Is Footprinting Necessary? . . . . . . . .
Internet Footprinting . . . . . . . . . . . . . . . . . .
Step 1. Determine the Scope of Your Activities
Step 2. Network Enumeration . . . . . . . . . .
Step 3. DNS Interrogation . . . . . . . . . . . .
Step 4. Network Reconnaissance . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Copyright 2001 The McGraw Hill Companies, Inc. Click Here for Terms of Use.
ix
x
Hacking Exposed: Network Security Secrets and Solutions
▼ 2 Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Scan Types . . . . . . . . . . . . . . . . . . . .
Identifying TCP and UDP Services Running
Windows-Based Port Scanners . . . . . . . .
Port Scanning Breakdown . . . . . . . . . . .
Active Stack Fingerprinting . . . . . . . . . .
Passive Stack Fingerprinting . . . . . . . . .
The Whole Enchilada: Automated Discovery Tools
Summary . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
▼ 3 Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
33
44
46
51
57
61
65
67
68
.
.
.
.
.
.
.
.
.
71
72
76
87
95
99
100
100
106
113
Case Study: Know Your Enemy . . . . . . . . . . . . . . . . . . . .
116
▼ 4 Hacking Windows 95/98 and ME . . . . . . . . . . . . . . . . . . . . . . .
117
118
119
124
129
130
130
137
138
Windows NT/2000 Enumeration . . . . . . . . . . . .
NT/2000 Network Resource Enumeration . . .
NT/2000 User and Group Enumeration . . . . .
NT/2000 Applications and Banner Enumeration
Let Your Scripts Do the Walking . . . . . . . . .
Novell Enumeration . . . . . . . . . . . . . . . . . . .
Browsing the Network Neighborhood . . . . . .
UNIX Enumeration . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Part II
System Hacking
Win 9x Remote Exploits . . . . . . . . . . . . . . . .
Direct Connection to Win 9x Shared Resources
Win 9x Backdoor Servers and Trojans . . . . .
Known Server Application Vulnerabilities . .
Win 9x Denial of Service . . . . . . . . . . . . .
Win 9x Local Exploits . . . . . . . . . . . . . . . . . .
Windows Millennium Edition (ME) . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
▼ 5 Hacking Windows NT . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
141
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Where We’re Headed . . . . . . . . . . . . . . . . . . . . . .
What About Windows 2000? . . . . . . . . . . . . . . . . . .
143
143
143
Contents
The Quest for Administrator . . . . . . . . . . . . . . . . . . . .
Remote Exploits: Denial of Service and Buffer Overflows
Privilege Escalation . . . . . . . . . . . . . . . . . . . . . .
Consolidation of Power . . . . . . . . . . . . . . . . . . . . . .
Exploiting Trust . . . . . . . . . . . . . . . . . . . . . . . .
Sniffers . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Remote Control and Back Doors . . . . . . . . . . . . . .
Port Redirection . . . . . . . . . . . . . . . . . . . . . . . .
General Countermeasures to Privileged Compromise . .
Rootkit: The Ultimate Compromise . . . . . . . . . . . . . . . .
Covering Tracks . . . . . . . . . . . . . . . . . . . . . . . . . . .
Disabling Auditing . . . . . . . . . . . . . . . . . . . . . .
Clearing the Event Log . . . . . . . . . . . . . . . . . . . .
Hiding Files . . . . . . . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
144
160
164
174
185
190
194
203
207
211
214
214
214
215
216
▼ 6 Hacking Windows 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . .
219
221
221
226
229
229
229
229
233
233
238
241
241
246
249
251
251
252
252
252
252
255
257
257
257
260
261
Footprinting . . . . . . . . . . . . . . . . . . . . . . . . . .
Scanning . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Enumeration . . . . . . . . . . . . . . . . . . . . . . . . . .
Penetration . . . . . . . . . . . . . . . . . . . . . . . . . . .
NetBIOS-SMB Password Guessing . . . . . . . . . .
Eavesdropping on Password Hashes . . . . . . . . .
Attacks Against IIS 5 . . . . . . . . . . . . . . . . . .
Remote Buffer Overflows . . . . . . . . . . . . . . .
Denial of Service . . . . . . . . . . . . . . . . . . . . . . .
Privilege Escalation . . . . . . . . . . . . . . . . . . . . . .
Pilfering . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Grabbing the Win 2000 Password Hashes . . . . . .
The Encrypting File System (EFS) . . . . . . . . . . .
Exploiting Trust . . . . . . . . . . . . . . . . . . . . .
Covering Tracks . . . . . . . . . . . . . . . . . . . . . . . .
Disabling Auditing . . . . . . . . . . . . . . . . . . .
Clearing the Event Log . . . . . . . . . . . . . . . . .
Hiding Files . . . . . . . . . . . . . . . . . . . . . . .
Back Doors . . . . . . . . . . . . . . . . . . . . . . . . . . .
Startup Manipulation . . . . . . . . . . . . . . . . .
Remote Control . . . . . . . . . . . . . . . . . . . . .
Keystroke Loggers . . . . . . . . . . . . . . . . . . .
General Countermeasures: New Windows Security Tools
Group Policy . . . . . . . . . . . . . . . . . . . . . .
runas . . . . . . . . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
xi
xii
Hacking Exposed: Network Security Secrets and Solutions
▼ 7 Novell NetWare Hacking . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
265
267
268
275
277
282
285
287
290
292
298
299
302
. . . .
. . . .
. . . .
302
303
303
▼ 8 Hacking UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.
.
.
.
.
.
.
.
.
.
.
.
.
305
306
306
307
307
308
312
317
322
339
357
358
369
370
. . . . . . . . . . . . . . . . . .
374
▼ 9 Dial-Up, PBX, Voicemail, and VPN Hacking . . . . . . . . . . . . . . . . .
377
380
380
381
382
Attaching but Not Touching . . . . . . . . . . . . . . . . . .
Enumerate Bindery and Trees . . . . . . . . . . . . . . . . .
Opening the Unlocked Doors . . . . . . . . . . . . . . . . .
Authenticated Enumeration . . . . . . . . . . . . . . . . . .
Gaining Admin . . . . . . . . . . . . . . . . . . . . . . . . .
Application Vulnerabilities . . . . . . . . . . . . . . . . . .
Spoofing Attacks (Pandora) . . . . . . . . . . . . . . . . . .
Once You Have Admin on a Server . . . . . . . . . . . . . .
Owning the NDS Files . . . . . . . . . . . . . . . . . . . . .
Log Doctoring . . . . . . . . . . . . . . . . . . . . . . . . . .
Console Logs . . . . . . . . . . . . . . . . . . . . . . .
Further Resources . . . . . . . . . . . . . . . . . . . . . . . .
Web Sites
(ftp://ftp.novell.com/pub/updates/nw/nw411/)
Usenet Groups . . . . . . . . . . . . . . . . . . . . . .
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Th…
Purchase answer to see full
attachment